[B.A.T.M.A.N.] [PATCH next 2/2] batman-adv: fix potential kernel paging error for unicast transmissions

Linus Lüssing
2013-07-27T01:24:45Z

batadv_send_skb_prepare_unicast(_4addr) might reallocate the skb's
data. If it does then our ethhdr pointer is not valid anymore in
batadv_send_skb_unicast(), resulting in a kernel paging error.

This patch fixes this issue by storing the few bytes we are interested
in on the stack before modifying the skb.

Signed-off-by: Linus Lüssing <linus.luessing@web.de>
---
unicast.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/unicast.c b/unicast.c
index 4c5a1aa..c636fd5 100644
--- a/unicast.c
+++ b/unicast.c
@@ -395,6 +395,7 @@ int batadv_unicast_generic_send_skb(struct batadv_priv *bat_priv,
struct sk_buff *skb, int packet_type,
int packet_subtype)
{
+ uint8_t dest[ETH_ALEN];
struct ethhdr *ethhdr = (struct ethhdr *)skb->data;
struct batadv_unicast_packet *unicast_packet;
struct batadv_orig_node *orig_node;
@@ -426,6 +427,8 @@ find_router:
if (!neigh_node)
goto out;

+ memcpy(dest, ethhdr->h_dest, sizeof(dest));
+
switch (packet_type) {
case BATADV_UNICAST:
if (!batadv_unicast_prepare_skb(skb, orig_node))
@@ -450,7 +453,7 @@ find_router:
* try to reroute it because the ttvn contained in the header is less
* than the current one
*/
- if (batadv_tt_global_client_is_roaming(bat_priv, ethhdr->h_dest))
+ if (batadv_tt_global_client_is_roaming(bat_priv, dest))
unicast_packet->ttvn = unicast_packet->ttvn - 1;

dev_mtu = neigh_node->if_incoming->net_dev->mtu;
--
1.7.10.4